Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers

A critical Apache OFBiz pre-authentication remote code execution vulnerability is being actively exploited using public proof of concept (PoC) exploits. Apache OFBiz (Open For Business) is an open-source enterprise resource planning system many businesses use for e-commerce inventory and order management, human resources operations, and accounting. OFBiz is part of Atlassian JIRA, a commercial project management and issue-tracking software used by over 120,000 companies worldwide. Therefore, any flaws in the open-source project are inherited by Atlassian's product. This authentication bypass flaw is tracked as CVE-2023-49070 and was fixed in OFBiz version 18.12.10, released on December 5, 2023. The issue potentially enabled attackers to elevate their privileges without authentication, perform arbitrary code execution, and access sensitive information. While investigating Apache's fix, which was to remove the XML-RPC code from OFBiz, SonicWall researchers discovered that the root cause for CVE-2023-49070 was still present. This incomplete fix still allowed attackers to exploit the bug in a fully patched version of the software. In a write-up published yesterday, SonicWall researchers demonstrate it's possible to bypass Apache's fix for the CVE-2023-49070 vulnerability when using specific credential combinations. "It was discovered while researching the root cause for the previously disclosed CVE-2023-49070," explains SonicWall's report. "The security measures taken to patch C...